Amazon Amazon Certifications CLF-C02 Questions & Answers

• Question 251:

  A company wants to define a central data protection policy that works across AWS services for compute, storage, and database resources.

  Which AWS service will meet this requirement?

  A. AWS Batch

  B. AWS Elastic Disaster Recovery

  C. AWS Backup

  D. Amazon FSx

  Correct Answer: C

  The AWS service that will meet this requirement is C. AWS Backup. AWS Backup is a service that allows you to define a central data protection policy that works across AWS services for compute, storage, and database resources. You can use AWS Backup to create backup plans that specify the frequency, retention, and lifecycle of your backups, and apply them to your AWS resources using tags or resource IDs. AWS Backup supports various AWS services, such as Amazon EC2, Amazon EBS, Amazon RDS, Amazon DynamoDB, Amazon EFS, Amazon FSx, and AWS Storage Gateway12. AWS Batch is a service that allows you to run batch computing workloads on AWS. AWS Batch does not provide a central data protection policy, but rather enables you to optimize the allocation and utilization of your compute resources3. AWS Elastic Disaster Recovery is a service that allows you to prepare for and recover from disasters using AWS. AWS Elastic Disaster Recovery does not provide a central data protection policy, but rather helps you minimize downtime and data loss by replicating your applications and data to AWS4. Amazon FSx is a service that provides fully managed file storage for Windows and Linux applications. Amazon FSx does not provide a central data protection policy, but rather offers features such as encryption, snapshots, backups, and replication to protect your file systems5. References:

  1: AWS Backup ?Centralized backup across AWS services 3: AWS Batch ?Run Batch Computing Jobs on AWS 2: Data Protection Reference Architectures with AWS Backup 4:

  AWS Elastic Disaster Recovery ?Prepare for and recover from disasters using AWS 5:

  Amazon FSx ?Fully managed file storage for Windows and Linux applications

• Question 252:

  A company is migrating its data center to AWS. The company needs an AWS Support plan that provides chat access to a cloud sup engineer 24 hours a day, 7 days a week. The company does not require access to infrastructure event management.

  What is the MOST cost-effective AWS Support plan that meets these requirements?

  A. AWS Enterprise Support

  B. AWS Business Support

  C. AWS Developer Support

  D. AWS Basic Support

  Correct Answer: B

  AWS Business Support is the most cost-effective AWS Support plan that provides chat access to a cloud support engineer 24/7. AWS Business Support also offers phone and email support, as well as a response time of less than one hour for urgent issues. AWS Business Support does not include access to infrastructure event management, which is a feature of AWS Enterprise Support. AWS Enterprise Support is more expensive and provides additional benefits, such as a technical account manager, a support concierge, and a response time of less than 15 minutes for critical issues. AWS Developer Support and AWS Basic Support do not provide chat access to a cloud support engineer. AWS Developer Support provides email support and a response time of less than 12 hours for general guidance issues. AWS Basic Support provides customer service and account support, as well as access to forums and documentation1

• Question 253:

  A company needs to store infrequently used data for data archives and long-term backups.

  A company needs a history report about how its Amazon EC2 instances were modified last month.

  Which AWS service can be used to meet this requirement?

  A. AWS Service Catalog

  B. AWS Config

  C. Amazon CloudWatch

  D. AWS Artifact

  Correct Answer: B

  AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. AWS Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. AWS Config can also track changes to your EC2 instances over time and provide a history report of the modifications. AWS Service Catalog, Amazon CloudWatch, and AWS Artifact are not the best services to meet this requirement. AWS Service Catalog is a service that allows you to create and manage catalogs of IT services that are approved for use on AWS. Amazon CloudWatch is a service that monitors your AWS resources and applications and provides metrics, alarms, dashboards, and logs. AWS Artifact is a service that provides on-demand access to AWS security and compliance reports and online agreements

• Question 254:

  Which option is a perspective that includes foundational capabilities of the AWS Cloud Adoption Framework (AWS CAF)?

  A. Sustainability

  B. Security

  C. Performance efficiency

  D. Reliability

  Correct Answer: B

  The AWS Cloud Adoption Framework (AWS CAF) helps organizations understand how cloud adoption transforms the way they work, and it provides structure to identify and address gaps in skills and processes. The AWS CAF organizes guidance into six areas of focus, called perspectives. Each perspective reflects a different stakeholder viewpoint with its own distinct responsibilities, skills, and attributes. The Security Perspective helps you structure the selection and implementation of security controls that meet your organization's needs2.

• Question 255:

  Which actions are best practices for an AWS account root user? (Select TWO.)

  A. Share root user credentials with team members.

  B. Create multiple root users for the account, separated by environment.

  C. Enable multi-factor authentication (MFA) on the root user.

  D. Create an IAM user with administrator privileges for daily administrative tasks, instead of using the root user.

  E. Use programmatic access instead of the root user and password.

  Correct Answer: CD

  The AWS account root user is the identity that has complete access to all AWS services and resources in the account. It is accessed by signing in with the email address and password that were used to create the account1. The root user should be protected and used only for a few account and service management tasks that require it1. Therefore, the following actions are best practices for an AWS account root user: Enable multi-factor authentication (MFA) on the root user. MFA is a security feature that requires users to provide two or more pieces of information to authenticate themselves, such as a password and a code from a device. MFA adds an extra layer of protection for the root user credentials, which can access sensitive information and perform critical operations in the account2. Create an IAM user with administrator privileges for daily administrative tasks, instead of using the root user. IAM is a service that helps customers manage access to AWS resources for users and groups. Customers can create IAM users and assign them permissions to perform specific tasks on specific resources. Customers can also create IAM roles and policies to delegate access to other AWS services or external entities3. By creating an IAM user with administrator privileges, customers can avoid using the root user for everyday tasks and reduce the risk of accidental or malicious changes to the account1.

• Question 256:

  A company encourages its teams to test failure scenarios regularly and to validate their understanding of the impact of potential failures. Which pillar of the AWS Well-Architected Framework does this philosophy represent?

  A. Operational excellence

  B. Cost optimization

  C. Performance efficiency

  D. Security

  Correct Answer: A

  This is the pillar of the AWS Well-Architected Framework that represents the philosophy of testing failure scenarios regularly and validating the understanding of the impact of potential failures. The operational excellence pillar covers the best practices for designing, running, monitoring, and improving systems in the AWS Cloud. Testing failure scenarios is one of the ways to improve the system's resilience, reliability, and recovery. You can learn more about the operational excellence pillar from this whitepaper or this digital course.

• Question 257:

  A company needs to engage third-party consultants to help maintain and support its AWS environment and the company's business needs.

  Which AWS service or resource will meet these requirements?

  A. AWS Support

  B. AWS Organizations

  C. AWS Service Catalog

  D. AWS Partner Network (APN)

  Correct Answer: D

  The AWS service or resource that will meet these requirements is D. AWS Partner Network (APN). AWS Partner Network (APN) is a global community of consulting and technology partners that offer a wide range of services and solutions for AWS customers. APN partners can help customers design, architect, build, migrate, and manage their workloads and applications on AWS. APN partners have access to various resources, training, tools, and support to enhance their AWS expertise and deliver value to customers12. AWS Support is a service that provides technical assistance and guidance for AWS customers. AWS Support offers different plans with varying levels of response time, access channels, and features. AWS Support does not directly engage third-party consultants, but rather connects customers with AWS experts and resources3. AWS Organizations is a service that allows customers to manage multiple AWS accounts within a single organization. AWS Organizations enables customers to create groups of accounts, apply policies, automate account creation, and consolidate billing. AWS Organizations does not directly engage third-party consultants, but rather helps customers simplify and optimize their AWS account management4. AWS Service Catalog is a service that allows customers to create and manage catalogs of IT services that are approved for use on AWS. AWS Service Catalog enables customers to control the configuration, deployment, and governance of their IT services. AWS Service Catalog does not directly engage third-party consultants, but rather helps customers standardize and streamline their IT service delivery5. References:

  1: AWS Partner Network (APN) - Amazon Web Services (AWS) 2: Find an APN Partner - Amazon Web Services (AWS) 3: AWS Support ?Amazon Web Services 4: AWS Organizations ?Amazon Web Services 5: AWS Service Catalog ? Amazon Web Services

• Question 258:

  An ecommerce company wants to distribute traffic between the Amazon EC2 instances that host its website.

  Which AWS service or resource will meet these requirements?

  A. Application Load Balancer

  B. AWS WAF

  C. AWS CloudHSM

  D. AWS Direct Connect

  Correct Answer: A

  This is the AWS service or resource that will meet the requirements of distributing traffic between the Amazon EC2 instances that host the website. Application Load Balancer is a type of Elastic Load Balancing that distributes incoming application traffic across multiple targets, such as Amazon EC2 instances, containers, IP addresses, and Lambda functions. Application Load Balancer operates at the application layer (layer 7) of the OSI model and supports advanced features such as path-based routing, host-based routing, health checks, and SSL termination. You can learn more about Application Load Balancer from [this webpage] or [this digital course].

• Question 259:

  Which AWS service or feature can a company use to apply security rules to specific Amazon EC2 instances?

  A. Network ACLs

  B. Security groups

  C. AWS Trusted Advisor

  D. AWS WAF

  Correct Answer: B

  Security groups are the AWS service or feature that can be used to apply security rules to specific Amazon EC2 instances. Security groups are virtual firewalls that control the inbound and outbound traffic for one or more instances. Customers can create security groups and add rules that reflect the role of the instance that is associated with the security group. For example, a web server instance needs security group rules that allow inbound HTTP and HTTPS access, while a database instance needs rules that allow access for the type of database12. Security groups are stateful, meaning that the responses to allowed inbound traffic are also allowed, regardless of the outbound rules1. Customers can assign multiple security groups to an instance, and the rules from each security group are effectively aggregated to create one set of rules1. Network ACLs are another AWS service or feature that can be used to control the traffic for a subnet. Network ACLs are stateless, meaning that they do not track the traffic that they allow. Therefore, customers must add rules for both inbound and outbound traffic3. Network ACLs are applied at the subnet level, not at the instance level. AWS Trusted Advisor is an AWS service that provides best practice recommendations for security, performance, cost optimization, and fault tolerance. AWS Trusted Advisor does not apply security rules to specific Amazon EC2 instances, but it can help customers identify security gaps and improve their security posture4. AWS WAF is an AWS service that helps protect web applications from common web exploits, such as SQL injection, cross-site scripting, and bot attacks. AWS WAF does not apply security rules to specific Amazon EC2 instances, but it can be integrated with other AWS services, such as Amazon CloudFront, Amazon API Gateway, and Application Load Balancer.

• Question 260:

  A company uses AWS Organizations. The company wants to apply security best practices from the AWS Well-Architected Framework to all of its AWS accounts.

  Which AWS service will meet these requirements?

  A. Amazon Macie

  B. Amazon Detective

  C. AWS Control Tower

  D. AWS Secrets Manager

  Correct Answer: C

  AWS Control Tower is the easiest way to set up and govern a secure, multi- account AWS environment based on best practices established through AWS's experience working with thousands of enterprises as they move to the cloud. With AWS Control Tower, builders can provision new AWS accounts in a few clicks, while you have peace of mind knowing your accounts conform to your organization's policies. AWS Control Tower automates the setup of a baseline environment, or landing zone, that is a secure, well- architected multi-account AWS environment1. AWS Control Tower helps you apply security best practices from the AWS Well-Architected Framework to all of your AWS accounts2.